The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1276 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    This advisory covers the RPM packages for the release.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * envoy: Incorrect configuration handling allows mTLS session re-use without re-validation     (CVE-2022-21654)

    * envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)

    * istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

    * nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)

    * ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)

    * golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

    * golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

    * envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)

    * envoy: Use-after-free when response filters increase response data (CVE-2021-43825)

    * envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)

    * envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)

    * istio: unauthenticated control plane denial of service attack (CVE-2022-23635)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1507-1 advisory.

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

  - The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an     attacker to panic an SSH server. (CVE-2021-43565)

  - containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in     containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd's CRI     implementation on Linux with a specially-crafted image configuration could gain access to read-only copies     of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container     setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information.
    Kubernetes and crictl can both be configured to use containerd's CRI implementation. This bug has been     fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.
    (CVE-2022-23648)

  - Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug     was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with     non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling     programs with inheritable file capabilities to elevate those capabilities to the permitted set during     `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise     unprivileged users and processes can execute those programs and gain the specified file capabilities up to     the bounding set. Due to this bug, containers which included executable programs with inheritable file     capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable     file capabilities up to the container's bounding set. Containers which use Linux users and groups to     perform privilege separation inside the container are most directly impacted. This bug did not affect the     container security sandbox as the inheritable set never contained more capabilities than were included in     the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers     should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes     Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a     workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop     inheritable capabilities prior to the primary process starting. (CVE-2022-24769)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-388 advisory.

    The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an     attacker to panic an SSH server. (CVE-2021-43565)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

    http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

    Templates did not properly consider backticks (`) as Javascript string delimiters, and as such didnot     escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a     Go template action within a Javascript template literal, the contents of the action couldbe used to     terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)

    The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

    Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack. (CVE-2023-3978)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1866 advisory.

    2023-10-30: CVE-2023-24540 was added to this advisory.

    The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an     attacker to panic an SSH server. (CVE-2021-43565)

    http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

    Templates did not properly consider backticks (`) as Javascript string delimiters, and as such didnot     escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a     Go template action within a Javascript template literal, the contents of the action couldbe used to     terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)

    html/template: improper handling of JavaScript whitespace.

    Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2303 advisory.

    2023-10-30: CVE-2023-29409 was added to this advisory.

    2023-10-30: CVE-2023-3978 was added to this advisory.

    2023-10-30: CVE-2023-29406 was added to this advisory.

    2023-10-30: CVE-2023-24540 was added to this advisory.

    The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an     attacker to panic an SSH server. (CVE-2021-43565)

    http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

    Templates did not properly consider backticks (`) as Javascript string delimiters, and as such didnot     escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a     Go template action within a Javascript template literal, the contents of the action couldbe used to     terminate the literal, injecting arbitrary Javascript code into the Go template. (CVE-2023-24538)

    html/template: improper handling of JavaScript whitespace.

    Not all valid JavaScript whitespace characters were considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

    The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

    Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack. (CVE-2023-3978)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an     attacker to panic an SSH server. (CVE-2021-43565)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03545-1 advisory.

    Note this update contains a already fixed references mostly.

    - Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. bsc#1250596

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Update to Go 1.23 for building now that upstream has switched their 23.0.x       LTSS to use Go 1.23.

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159603	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.9 (RHSA-2022:1276)	Nessus	Red Hat Local Security Checks	2022/4/8	2024/11/7	critical
160493	SUSE SLES12 Security Update : containerd, docker (SUSE-SU-2022:1507-1)	Nessus	SuSE Local Security Checks	2022/5/4	2023/7/14	high
183829	Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-388)	Nessus	Amazon Linux Local Security Checks	2023/10/24	2025/9/11	critical
183853	Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1866)	Nessus	Amazon Linux Local Security Checks	2023/10/25	2024/12/11	critical
183477	Amazon Linux 2 : amazon-ssm-agent (ALAS-2023-2303)	Nessus	Amazon Linux Local Security Checks	2023/10/20	2024/12/11	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
224220	Linux Distros Unpatched Vulnerability : CVE-2021-43565	Nessus	Misc.	2025/3/5	2026/4/28	high
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	2025/10/11	2025/10/11	critical
270307	SUSE SLES15 / openSUSE 15 Security Update : docker-stable (SUSE-SU-2025:03545-1)	Nessus	SuSE Local Security Checks	2025/10/14	2025/10/15	critical

检测

插件搜索

critical

high

critical

critical

critical

critical

high

critical

critical